CVE-2019-12155

interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

• QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

• QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

• QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

• QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).
• CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031).

Bug fixes and enhancements:

• Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883)
• Add SnowRidge-Server vcpu model (jsc#SLE-4883)
• Add in documentation about md-clear feature (bsc#1138534)
• Fix SEV issue where older machine type is not processed correctly (bsc#1144087)
• Fix case of a bad pointer in Xen PV usb support code (bsc#1128106)
• Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764)
• Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)
• Ignore csske for expanding the cpu model (bsc#1136540)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements:

• Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)
• Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)
• Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).
• Ignore csske for expanding the cpu model (bsc#1136540)
• Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for kvm fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

This update for xen fixes the following issues:

• CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).
• CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).
• CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).
• CVE-2019-12067: Fixed a null pointer dereference which could have led to denial of service (bsc#1145652).
• CVE-2019-12155: Fixed a null pointer dereference in QXL VGA card emulator of QEMU which could have led to denial of service (bsc#1135905).

This update for xen fixes the following issues:

• CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).
• CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).
• CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).
• CVE-2019-12067: Fixed a null pointer dereference which could have led to denial of service (bsc#1145652).
• CVE-2019-12155: Fixed a null pointer dereference in QXL VGA card emulator of QEMU which could have led to denial of service (bsc#1135905).
• CVE-2018-20815: Fixed a heap buffer overflow while loading device tree blob (bsc#1130680).
• CVE-2017-10806: Fixed a stack buffer overflow in debug logging (bsc#1047675).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).
• CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031).

Bug fixes and enhancements:

• Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883)
• Add SnowRidge-Server vcpu model (jsc#SLE-4883)
• Add in documentation about md-clear feature (bsc#1138534)
• Fix SEV issue where older machine type is not processed correctly (bsc#1144087)
• Fix case of a bad pointer in Xen PV usb support code (bsc#1128106)
• Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764)
• Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)
• Ignore csske for expanding the cpu model (bsc#1136540)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements:

• Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)
• Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)
• Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).
• Ignore csske for expanding the cpu model (bsc#1136540)
• Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).
• CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).
• CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements:

• Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134880) (fate#327764).
• Add support for one more security/performance related vcpu feature (bsc#1136777) (fate#327795).
• Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).
• Ignore csske for expanding the cpu model (bsc#1136528).
• Provide qcow2 L2 caching improvements, which allows for better storage performance in certain configurations (bsc#1139926, ECO-130).
• Fixed virsh migrate-setspeed (bsc#1127077, bsc#1141043).

This update for xen fixes the following issues:

• CVE-2018-12207: Fixed a race condition where untrusted virtual machines could have been using the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional (bsc#1155945 XSA-304).
• CVE-2018-19965: Fixed a DoS from attempting to use INVPCID with a non-canonical addresses (bsc#1115045 XSA-279).
• CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate side-channel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497 XSA-305).
• CVE-2019-12067: Fixed a null pointer dereference in QEMU AHCI (bsc#1145652).
• CVE-2019-12068: Fixed an infinite loop while executing script (bsc#1146874).
• CVE-2019-12155: Fixed a null pointer dereference while releasing spice resources (bsc#1135905).
• CVE-2019-14378: Fixed a heap buffer overflow during packet reassembly in slirp networking implementation (bsc#1143797).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly (bsc#1149813).
• CVE-2019-17340: Fixed grant table transfer issues on large hosts (XSA-284 bsc#1126140).
• CVE-2019-17341: Fixed a race with pass-through device hotplug (XSA-285 bsc#1126141).
• CVE-2019-17342: Fixed steal_page violating page_struct access discipline (XSA-287 bsc#1126192).
• CVE-2019-17343: Fixed an inconsistent PV IOMMU discipline (XSA-288 bsc#1126195).
• CVE-2019-17344: Fixed a missing preemption in x86 PV page table unvalidation (XSA-290 bsc#1126196).
• CVE-2019-17347: Fixed a PV kernel context switch corruption (XSA-293 bsc#1126201).
• CVE-2019-18420: Fixed a hypervisor crash that could be caused by malicious x86 PV guests, resulting in a denial of service (bsc#1154448 XSA-296).
• CVE-2019-18421: Fixed a privilege escalation through malicious PV guest administrators (bsc#1154458 XSA-299).
• CVE-2019-18424: Fixed a privilege escalation through DMA to physical devices by untrusted domains (bsc#1154461 XSA-302).
• CVE-2019-18425: Fixed a privilege escalation from 32-bit PV guest used mode (bsc#1154456 XSA-298).
• CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311).
• CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309).
• CVE-2019-19579: Fixed a privilege escalation where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306).
• CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310).
• CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307).
• CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest, leading to a guest denial of service (bsc#1158004 XSA-308).

It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate executed scripts. A local attacker could use this to cause a denial of service. (CVE-2019-12068)

Sergej Schumilo, Cornelius Aschermann and Simon Wörner discovered that the qxl paravirtual graphics driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-12155)

Riccardo Schirone discovered that the QEMU bridge helper did not properly validate network interface names. A local attacker could possibly use this to bypass ACL restrictions. (CVE-2019-13164)

It was discovered that a heap-based buffer overflow existed in the SLiRP networking implementation of QEMU. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. (CVE-2019-14378)

It was discovered that a use-after-free vulnerability existed in the SLiRP networking implementation of QEMU. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-15890)

USN-4191-2 fixed a vulnerability in QEMU. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate executed scripts. A local attacker could use this to cause a denial of service. (CVE-2019-12068)

Sergej Schumilo, Cornelius Aschermann and Simon Wörner discovered that the qxl paravirtual graphics driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-12155)

Riccardo Schirone discovered that the QEMU bridge helper did not properly validate network interface names. A local attacker could possibly use this to bypass ACL restrictions. (CVE-2019-13164)

It was discovered that a heap-based buffer overflow existed in the SLiRP networking implementation of QEMU. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. (CVE-2019-14378)

It was discovered that a use-after-free vulnerability existed in the SLiRP networking implementation of QEMU. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-15890)